Palo Alto Networks PCNSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCNSE Online Questions & Answers

• Question 611:

  A company with already deployed Palo Alto firewalls has purchased their first Panorama server. The security team has already configured all firewalls with the Panorama IP address and added all the firewall serial numbers in Panorama. What are the next steps to migrate configuration from the firewalls to Panorama?

  A. Use API calls to retrieve the configuration directly from the managed devices
  B. Export Named Configuration Snapshot on each firewall followed by Import Named Configuration Snapshot in Panorama
  C. import Device Configuration to Panorama followed by Export or Push Device Config Bundle
  D. Use the Firewall Migration plugin to retrieve the configuration directly from the managed devices
  C. import Device Configuration to Panorama followed by Export or Push Device Config Bundle

  ---

  Explanation

• Question 612:

  An engineer troubleshoots a Panorama-managed firewall that is unable to reach the DNS servers configured via a global template. As a troubleshooting step, the engineer needs to configure a local DNS server in place of the template value.

  Which two actions can be taken to ensure that only the specific firewall is affected during this process? (Choose two.)

  A. Override the DNS server on the template stack.
  B. Configure the DNS server locally on the firewall.
  C. Change the DNS server on the global template.
  D. Configure a service route for DNS on a different interface.
  A. Override the DNS server on the template stack.
  B. Configure the DNS server locally on the firewall.

  ---

  Explanation

  To override a device and network setting applied by a template, you can either configure the setting locally on the firewall or override the setting on the template stack. Configuring the setting locally on the firewall will copy the setting to the local configuration of the device and will no longer be controlled by the template. Overriding the setting on the template stack will apply the setting to all the firewalls that are assigned to the template stack, unless the setting is also overridden locally on a firewall. Changing the setting on the global template will affect all the firewalls that inherit the setting from the template, which is not desirable in this scenario. Configuring a service route for DNS on a different interface will not change the DNS server address, but only the interface that the firewall uses to reach the DNS server.

  References: Override a Template Setting How to override panorama pushed template configuration on the local firewall Overriding Panorama Template settings

• Question 613:

  What can be used to create dynamic address groups?

  A. dynamic address
  B. region objects
  C. tags
  D. FODN addresses
  C. tags

  ---

  Explanation

• Question 614:

  Which statement is correct given the following message from the PanGPA log on the GlobalProtect app? Failed to connect to server at port:47 67

  A. The PanGPS process failed to connect to the PanGPA process on port 4767
  B. The GlobalProtect app failed to connect to the GlobalProtect Portal on port 4767
  C. The PanGPA process failed to connect to the PanGPS process on port 4767
  D. The GlobalProtect app failed to connect to the GlobalProtect Gateway on port 4767
  C. The PanGPA process failed to connect to the PanGPS process on port 4767

  ---

  Explanation

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clk6CAC

• Question 615:

  An administrator has been asked to configure a Palo Alto Networks NGFW to provide protection against worms and trojans. Which Security Profile type will protect against worms and trojans?

  A. Anti-Spyware
  B. WildFire
  C. Vulnerability Protection
  D. Antivirus
  D. Antivirus

  ---

  Explanation

  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/objects/objects-security-profiles

• Question 616:

  A traffic log might list an application as "not-applicable" for which two reasons'? (Choose two )

  A. The firewall did not install the session
  B. The TCP connection terminated without identifying any application data
  C. The firewall dropped a TCP SYN packet
  D. There was not enough application data after the TCP connection was established
  A. The firewall did not install the session
  D. There was not enough application data after the TCP connection was established

  ---

  Explanation

• Question 617:

  What happens when an A P firewall cluster synchronies IPsec tunnel security associations (SAs)?

  A. Phase 2 SAs are synchronized over HA2 finks
  B. Phase 1 and Phase 2 SAs are synchronized over HA2 links
  C. Phase 1 SAs are synchronized over HA1 links
  D. Phase 1 and Phase 2 SAs are synchronized over HA3 links
  A. Phase 2 SAs are synchronized over HA2 finks

  ---

  Explanation

  From the Palo Alto documentation below, "when a VPN is terminated on a Palo Alto firewall HA pair, not all IPSEC related information is synchronized between the firewalls... This is an expected behavior. IKE phase 1 SA information is NOT

  synchronized between the HA firewalls."

  And from the second link, "Data link (HA2) is used to sync sessions, forwarding tables, IPSec security associations, and ARP tables between firewalls in the HA pair. Data flow on the HA2 link is always unidirectional (except for the HA2 keep-alive). It flows from the active firewall to the passive firewall."

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HAuZCAWandlang=en_US%E2%80%A9andrefURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

  https://help.aryaka.com/display/public/KNOW/Palo+Alto+Networks+NFV+Technical+Brief

• Question 618:

  Which two statements are correct for the out-of-box configuration for Palo Alto Networks NGFWs? (Choose two)

  A. The devices are pre-configured with a virtual wire pair out the first two interfaces.
  B. The devices are licensed and ready for deployment.
  C. The management interface has an IP address of 192.168.1.1 and allows SSH and HTTPS connections.
  D. A default bidirectional rule is configured that allows Untrust zone traffic to go to the Trust zone.
  E. The interface are pingable.
  B. The devices are licensed and ready for deployment.
  C. The management interface has an IP address of 192.168.1.1 and allows SSH and HTTPS connections.

  ---

  Explanation

• Question 619:

  Using multiple templates in a stack to manage many firewalls provides which two advantages? (Choose two.)

  A. inherit address-objects from templates
  B. define a common standard template configuration for firewalls
  C. standardize server profiles and authentication configuration across all stacks
  D. standardize log-forwarding profiles for security polices across all stacks
  B. define a common standard template configuration for firewalls
  C. standardize server profiles and authentication configuration across all stacks

  ---

  Explanation

  Template stacks simplify management because they allow you to define a common base configuration for all devices attached to the template stack and they give you the ability to layer templates to create a combined configuration.

• Question 620:

  Which method will dynamically register tags on the Palo Alto Networks NGFW?

  A. Restful API or the VMWare API on the firewall or on the User-ID agent or the read-only domain controller (RODC)
  B. Restful API or the VMware API on the firewall or on the User-ID agent
  C. XML-API or the VMware API on the firewall or on the User-ID agent or the CLI
  D. XML API or the VM Monitoring agent on the NGFW or on the User-ID agent
  D. XML API or the VM Monitoring agent on the NGFW or on the User-ID agent

  ---

  Explanation

  https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/monitor-changes-in-the-virtual-environment/use-dynamic-address-groups-in-policy.html

  dynamically register tags, you can use the XML API or the VM Monitoring agent on the firewall or on the User-ID agent. Each tag is a metadata element or attribute-value pair that is registered on the firewall or Panorama. For example, IP1 {tag1, tag2,.....tag32}, w"